Cybersecurity briefing, 2026-10-24

Arista says attackers are actively exploiting a VeloCloud Orchestrator flaw on on-premises deployments.

• Ransomware affiliates use AI to coordinate edge intrusions
• Ruby regex bugs expose applications beyond GitLab
• Arista VeloCloud flaw grants low-privilege users operator access
• ConnectWise backup breach opened a route into Microsoft 365
• French supermarket refrigeration attacks spoiled food and disrupted stores
• k0t used edge devices to persist and steal data
• Trimble Cityworks flaw opens IIS servers to attackers
• Stolen Microsoft 365 tokens opened accounts across 79 organizations
• APT41's BlackX bootkit keeps Baton Drop in play
• UAC-0099's July foothold preceded Sandworm's September wipe
• LiteLLM malware steals credentials beyond the gateway
• Node.js Brotli flaw reaches code execution on official build
• Symantec's captured agent design routes attacks through hijacked AI
• Quest Quanum breach disrupts lab orders as exposure stays unknown

Recent editions

• Friday, October 23, 2026: Ruby regex bugs expose applications beyond GitLab · 19 stories
• Thursday, October 22, 2026: PHP2Shell attempts still fall short of confirmed infection · 18 stories
• Wednesday, October 21, 2026: Cisco's eMudhra review leaves product exposure unresolved · 16 stories
• Tuesday, October 20, 2026: Siemens signed launcher hides a trojanized installer · 15 stories
• Monday, October 19, 2026: Rank Math PRO backdoor outlives the plugin · 18 stories
• Sunday, October 18, 2026: PwnEscape breaks Linux VM isolation at the host layer · 1 story
• Saturday, October 17, 2026: CISA puts BeyondTrust zero-day on the clock · 11 stories